This invention relates to a method and apparatus for detecting computer viruses on computers which have files consisting of more than one fork, and more particularly to a method and apparatus for increasing the speed at which a computer having files with more than one fork can scan for the presence of a virus.
The computer field in general has been plagued by the introduction of programs known as computer "viruses", "worms", or "Trojan horses". These programs are often introduced for malicious reasons, and often result in significant damage to both stored data and other software. Many software solutions have been devised to help counter this growing threat to computer file integrity. Among these solutions is a general virus scanner program which scans a file or set of files, for particular known viruses. This method of virus detection is particularly effective against known viruses.
Computer viruses have the particular property being able to replicate themselves and thus spread from one computer file to another, one computer volume to another, and eventually, from one machine to another. The virus may not be designed to do anything intentionally malicious, but to qualify as a virus, it must have the capability of replicating itself. This distinguishes computer viruses from programs such as "Trojan horses".
Viruses may spread in a number of ways. For example, a virus may spread by adding itself to code that already exists within some program on a computer, then changing that preexisting code in such a way that the newly added viral code will be executed. This will then enable the virus to execute again and replicate itself in yet another program. Examples of such viruses that have affected the Apple Macintosh computer are commonly referred to as nVIR, Scores, ZUC, and ANTI.
A virus may also add itself to some preexisting program (or to the system), but may do so in such a way that it will be automatically executed by the system software running on the computer. It will thus not have to actually modify any preexisting code. Examples of such viruses that have affected the Apple Macintosh computer are named WDEF and CDEF.
The general method for virus scanning is to examine all volume information and files that may be infected by a virus. During the scan each individual virus (or group of viruses) is searched for by looking for the actual vital code, or certain other telltale signs of a virus, such as modified program code. The simplest method to accomplish this is to look for a predetermined string of hexadecimal bytes, the presence of which indicates a specific virus infection. Currently available programs distributed under the names SAM and Disinfectant scan in this manner.
Referring to FIG. 1, the operation of a typical scanning process for a Macintosh computer will now be described. Each volume or directory of files is scanned with the scan starting in step 10. In a preferred embodiment, each file of the volume is scanned starting in step 12. Each file is scanned by examining its resource fork in step 14 and its data fork in step 16 for viruses. Note that the scan process may be as simple as determining that the file is not of a type infected by viruses, or that the file has no resource or data fork, and thus does not have to be examined directly for the presence of a virus. This process is repeated for each volume and each file.
In recent years, not only has the number of viruses increased, but the frequency with which they appear has also generally increased. As the number of viruses increase, the anti-virus programs which use file scanning technologies to search for these viruses must increase their scanning capabilities to handle the new viruses. This increased scanning capability requires extra time to accomplish the scan. Further limitations are imposed on systems which have users with large numbers of files requiring scanning or with moderate to slow computer systems. The overall result of these additional limitations is an increase in the amount of time needed to detect viruses, with a future that promises further increases.
In order to reduce the time it takes to scan for a virus, other solutions have been developed. One such solution introduces programs which detect viral activity, but do not detect specific viruses. Such programs are useful, especially if used in conjunction with vital scanning programs. Such programs, however, do not have the required power and ease of use necessary to supplant the virus scanning programs.
Other solutions simplify and improve detection software in order to speed performance. This has also been useful but as the number of computer viruses increase (sometimes at a seemingly exponential rate), the slowdown due to this increase cancels any time improvement gained from simplifying the software.
There are, however, a number of complexities in applying scan techniques that examine the sizes or other characteristics of files or volumes to computer systems with multi-fork file systems. For example, viruses may in some way infect one fork of a file without changing that fork's length by using another fork of the file. Consequently there may be an interrelation between file forks which must be properly handled to maintain virus scanning integrity.
As another example, file compression on computers with multi-fork file systems adds an additional level of complexity. File compressors on such computers may compress all forks of a file into a single fork. Additional care must be taken both to maintain scanning integrity and to achieve optimum speed enhancement when scanning such compressed files.
A third example involves the nature of multi-fork file storage on computers such as the Apple Macintosh. Typically one fork of a file, for example the resource fork on Macintosh computers, may contain a kind of small database which is used to contain many kinds of data, including application code, icons, preferences, strings, templates, and other such items. A change in size to such a fork may not indicate a change to application code, but rather a change to something else such as user preferences. It is therefore necessary to handle this complexity in a proper manner so as to optimize speed enhancement without compromising scan effectiveness.
In yet another example, on computers with multi-fork files, files which do not contain application or other code for execution may contain virus infections. In some cases under the proper circumstances these viruses may in fact be executed by the system allowing the virus to spread, although they do not reside in what would be termed an "executable" file. This situation arises due to the nature of such computers and their handling of the file forks containing the previously mentioned small database. Proper care must be taken to detect all such viruses, yet at the same time still obtain the maximum speed enhancement.
A fifth example of the complexity of applying such scan techniques to computers with multi-fork file systems again concerns the nature of the multiple forks on such computers and the means of infection employed by viruses. Typically a virus would add itself to the fork of a file. However, depending upon the virus, the type of file being infected, and the specific circumstances of the infection, a virus which normally would add itself may in fact overlay some already existing code in certain files which it is infecting. All such particular cases for all viruses infecting the computer on which the present invention is being applied must be taken into account to guarantee scanning integrity.
It is, therefore, a principal object of the present invention to provide a method and apparatus for increasing the speed at which a computer having files with more than one fork can scan for the presence of a computer virus.
Another object of the present invention is to provide a method and apparatus for scanning for a computer virus which eliminates the necessity of scanning all portions of all files and volumes for all viruses.
A further object of the present invention is to provide a method and apparatus for handling the complexities of increasing the speed at which a computer having files with more than one fork can scan for the presence of a computer virus which complexities are due to the multi-fork nature of the file systems on such computers.